ci: fail only the pull request that adds an unregistered test

.github/workflows/ci-guards.yml

@@ -145,6 +145,10 @@ jobs:
           fi
           python3 scripts/ci/validate_test_execution_registry.py "${args[@]}"
 
+      - name: Validate Python test execution registry blast radius
+        if: ${{ matrix.group == 'preflight' }}
+        run: python3 tests/test_ci_test_execution_registry.py
+
       - name: Validate dev-fleet warm-slot lifecycle
         if: ${{ matrix.group == 'preflight' }}
         run: |

scripts/ci/test_execution_registry.py

@@ -8,11 +8,21 @@
 
 
 def load_registry(path: Path) -> list[dict[str, object]]:
+    return parse_registry(path.read_text(encoding="utf-8"), str(path))
+
+
+def parse_registry(text: str, label: str) -> list[dict[str, object]]:
+    """Parse registry text. `label` names the source in error messages.
+
+    The validator reads the base branch's registry through `git show`, which
+    has no path on disk, so parsing is separate from reading.
+    """
     version: object = None
     tests: list[dict[str, object]] = []
     current: Optional[dict[str, object]] = None
+    path = label
 
-    for line_number, raw_line in enumerate(path.read_text(encoding="utf-8").splitlines(), start=1):
+    for line_number, raw_line in enumerate(text.splitlines(), start=1):
         line = raw_line.strip()
         if not line or line.startswith("#"):
             continue